We are having issues getting Splunk to process log files in windows, The identical configuration works in linux.
Appreciate any help in identifying what the problem could be
This does not work
[batch://E:\DATA\FTP\*.log.gz]
host_regex = E:\DATA\FTP\[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
sourcetype = bluecoat:proxysg:access:file
index = ip-bluecoat
move_policy = sinkhole
disabled = false
This works
[batch:///home/ec2-user/temp/*.log.gz]
host_regex = /home/ec2-user/temp/[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
sourcetype = bluecoat:proxysg:access:file
index = ip-bluecoat
move_policy = sinkhole
disabled = false
Sample log file names:
AB_main_abc123_20151124230023.log
AB_main_2_abc123__2341124210817.log
Splunk version is 6.3
Have you tried escaping your backslashes?
host_regex = E:\\DATA\\FTP\\[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
Have you tried escaping your backslashes?
host_regex = E:\\DATA\\FTP\\[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
@richgalloway, Yes tried escaping backslashes, no change.
I have tried but got nothing changed too. Any other ways for that?
@ChloeMica, If you are defining source explicitly in inputs.conf then splunk uses that string to match not the original filename.
"Detail: This feature examines the source key; if source is set explicitly in the stanza, that string will be matched, not the original filename." - http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Inputsconf
Could that be your case ?
Thanks this solution indeed works!